qilingframework / qilingframework/qiling

LDR error while loading windows shellcode

Open
#1,415 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
6.1k
Forks
798
Avg merge
1d 1h
Merged PRs (30d)
9

Description

Describe the bug
The LDR table is wrong when loading windows shellcode.
The first record is not process image.
I find it's same as #1043 that was closed:

LDR sequence error
InLoadOrderLinks= ntdll, kernel32, ...
InMemoryOrderLinks= ntdll,kernel32, ...
InInitializationOrderLinks= ntdll, kernel32, ... (no process entry)

The correct order should be
InLoadOrderLinks= process, ntdll, kernel32, ...
InMemoryOrderLinks= process, ntdll, kernel32, ...
InInitializationOrderLinks= ntdll, kernel32, ... (no process entry)

Sample Code
get kernel32 base by from PEB and InLoadOrderModuleList

from qiling import Qiling
from qiling.const import *

'''
40000 64A130000000  mov eax, dword ptr fs:[30]   ; PEB
40006 8B400C        mov eax, dword ptr [eax+0c]  ; PEB_LDR_DATA
40009 8B400C        mov eax, dword ptr [eax+0c]  ; InLoadOrderModuleList, record of process image
4000C 8B00          mov eax, dword ptr [eax]     ; next module, record of ntdll
4000E 8B00          mov eax, dword ptr [eax]     ; next module, record of kernel32
40010 8B4018        mov eax, dword ptr [eax+18]  ; base of kernel32
40013 C3            ret                          ; at last $EAX = base of kernel32
'''
shellcode = bytes.fromhex('64a1300000008b400c8b400c8b008b008b4018c3')

ql= Qiling(code=shellcode, archtype=QL_ARCH.X86, ostype=QL_OS.WINDOWS,
           rootfs='examples/rootfs/x86_windows', verbose=QL_VERBOSE.DEBUG)

# ret, $eax should = base addr of kernel32.dll 
ql.debugger = "qdb:0x40013"
ql.run()

Expected behavior
The first entry of LDR should be process image while loading windows shellcode.

Additional context
I checked the source code and found that when normal PE files are loaded, PE image is added to ldr first, while shellcode is not.
https://github.com/qilingframework/qiling/blob/master/qiling/loader/pe.py#L772

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the shellcode reproducer in the issue, then inspect qiling/loader/pe.py around line 772 and compare normal PE loading with shellcode loading. Verify the LDR lists while running the sample and confirm that the first InLoadOrderModuleList and InMemoryOrderModuleList entries are the process image, while the initialization list remains unchanged and EAX resolves kernel32.dll.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
operating-systems, reverse-engineering
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.